Embodiments of the present invention relate generally to configuration and management of distributed computer systems, and more particularly to configuration and use of service policies in such systems.
Enterprise computer systems can be structured as components that interact with each other via defined interfaces. A component that provides an element of functionality, such as executing a transaction, computing a value, storing information in a database, and other operations, can be provided in the form of a web service, which has a defined input service interface of one or more operations and associated input parameters, and, ordinarily, a defined reference interface of operations that the web service invokes, e.g., to delegate tasks to other web services. The reference interface corresponds to the service interface of the web service to be invoked. These invocations can be performed by, for example, sending messages via a computer network from an invoking service or application to the referenced service. Service Oriented Architectures (SOA) provide frameworks and conventions for creating applications using this service-oriented architecture.
SOA provides features for specifying desired “quality of service” parameters that applications and services are to adhere to when invoking services and processing service invocations, respectively. One type of quality of service is security, which includes user authentication, data encryption, authorization of users to perform particular operations, and the like. Security-related parameters, such as details of how security is to be implemented, e.g., which type of authentication and encryption to use, can be specified by system users or administrators as “security policies” that can be attached to or associated with service input interfaces and reference interfaces. A security policy can be understood as a data item that includes a specific value for a parameter, e.g., the name of a specific type of encryption. When a security policy is attached to a service, the service can implement security features in accordance with the parameters specified in the policy. Thus, application developers can provide flexible security features by implementing security with reference to policies that can be supplied later, e.g., when the application is deployed for use by a customer, or when the customer's security needs change. The customer can then provide specific policies to configure the security features, e.g., by specifying a particular type of encryption with a particular level of security. The customer associates a security policy with each security-sensitive service using an administrative tool, such as a graphical user interface. When security requirements change, the customer can change the policies accordingly. Other types of quality of service configuration can be performed similarly.
For example, the quality of service of network communication may be configurable between higher-quality settings that have slower performance and lower-quality settings that are faster. A network protocol quality of service parameter can be provided by the application, and a customer who deploys the application can specify a particular setting for the quality of service, e.g., reliable or guaranteed, by attaching a policy that specifies the particular setting to the services in the application.